Managed Detection and Response cover Giacomo Lanzi

Managed Detection and Response: a new preventive approach

Estimated reading time: 6 minutes

The constant use of communications over the network in a corporate context makes it essential to take precautions for computer security. As we have seen on other occasions, the dangers can come from different fronts: phishing , ransomware , data breach , etc. The implementation of new strategies such as Managed Detection and Response allows to mitigate risks and identify potential threats.

In this article, we’ll take a closer look at this new approach, focusing on advanced threats and the benefits of this new approach for businesses.

Managed Detection and Response security

Advanced-persistent-threats and SIEMs

A search of CardinalOPS , carried out on Fortune 1000 companies, highlights how companies using a system SIEM , however, encounter problems of cyber attacks. This is due, as Yair Manor, co-founder of CardinalOPS, in part to the visibility . Basically, the big companies have no real knowledge of the extent of their infrastructures and this leaves some openings from which it is possible to enter.

Systems with SIEM implementation, although they guarantee good IT security, are often mishandled by internal company technicians. Research shows that only 16% of standard threat protection techniques are actually applied by employees . Interesting data that show how an average of 25% of SIEM rules are violated or even never activated by security officers. It is therefore not easy to determine what are the best criteria to apply once the cyber attacks have occurred.

Among the 1000 companies surveyed, many of them invest considerable capital, in the billions of dollars, in order to identify the greatest number of correlations and events related to the corporate attack.

The process of constant improvement of SIEM systems underlines how this can be a real solution with a centralization and rationalization of the flow of incidents. In addition to choosing an effective security system, it is essential to have experienced technicians to be able to use the tools correctly.

Managed Detection Services & amp; Response: what are they

As noted in the previous lines, a SIEM-based system is effective, but not foolproof . In a situation where there is uncertainty of reliability, a new strategy is born to mitigate the risk. Specifically, there was the introduction of the Security Orchestration, Automation & amp; Response (SOAR) in SOCs, capable of automating repetitive workloads and detecting false positives. We also talked about it in a specific article in which we analyzed the advantages of this approach.

As it is easy to deduce, not all companies have implemented an efficient SOC system in their company, although it is now possible to find “ as a Service ” versions such as what we offer .

In this context, where the ability to identify the anomalous threat in the shortest possible time is essential, an innovative strategy is placed: Managed Detection & amp; Response (MDR) .

This service strategy is about identifying the threat as quickly as possible and containing it before it reaches its maximum level . There is therefore a change of approach due to the need to monitor potential threats around the clock. This is possible with a dedicated service capable of carrying out surveys 24 hours a day and for the whole week .

This approach implements an advanced, intelligent analysis aimed at reporting and solving the problem. Companies that choose our SOCaaS can take advantage of a service capable of speeding up the collection process and data analysis, freeing them from potential threats .

It should also be considered that the automation of the collection and analysis phases lowers maintenance prices for the company’s IT department. An advantage that cannot be ignored, offered by the decentralization of security services, such as SOCaaS from SOD.

The advantages of MDR

In order to fully understand the potential of Managed Detection and Response, it is advisable to analyze the concrete benefits that individuals and companies find in this service.

Organizations using an MDR solution can immediately reduce detection time (and therefore response time). Threats can be identified in minutes, giving you the ability to take immediate action.

But reducing time-to-detect from months to minutes isn’t the only advantage of an MDR. Companies can also:

  • Increase resilience to potential attacks by optimizing the security configuration and eliminating rogue systems .
  • Identify and stop hidden and sophisticated threats through a continuous threat hunting .
  • Respond to threats more effectively and restore endpoints to a known state through guided response and managed remediation.
  • Redirect personnel from response work to reactive and repetitive incidents towards more strategic projects.

The incidence of ransomware

Companies know very well that one of the most difficult problems to eradicate within the corporate IT context, is the ransomware . A Managed Detection and Response strategy can defeat these threats and better manage phishing campaigns. Although employees may have a good background in cybersecurity, in many cases they are prone to trivial errors . In this regard, we recommend that you evaluate our ethical phishing service, to focus on training as a weapon against phishing .

Companies that do not have a dedicated team, in many cases manage cybersecurity with superficiality, belittling and underestimating the simplest cyber attacks. Being able to preventively eliminate a potential problem is a benefit that should not be underestimated, especially if you are bound to a continuous flow of incoming and outgoing data.

Managed Detection and Response cover

Prevention

The MDR strategy aims to prevent attacks and not to eradicate them once they are unassailable. Unfortunately, dealing with a cyber attack is particularly expensive, not only due to the difficulty of recovering the lost information, but also to restore its correct functioning.

A prevention service is the ideal answer to free yourself from potential dangers , protecting not only your company, but also the employees who can become victims in turn.

Conclusions: a concrete solution

Not all MDR services are identical to each other and it is advisable to rely on those who have been working for years and are committed to making this technology more and more effective.

The services offered by SOD, such as SOCaaS, guarantee an ideal solution for every company . Thanks to the introduction of state-of-the-art security software and solutions, SOD is in a position to offer a service aimed at the best possible prevention for corporate protection.

Customization and the choice of a dedicated service allow you to better manage company production. In an age when it is essential to protect yourself from cyber threats, a service dedicated to prevention is the smartest solution.

If you want to know how our solutions can help your business, do not hesitate to contact us, we will be happy to answer any questions.

Useful links:

SOAR: coordination for cyber security

SOAR: what it is and how it can be useful for companies

What is threat intelligence?

Use cases of a SOCaaS for companies part 2

Share


RSS

More Articles…

Categories …

Tags

RSS darkreading

RSS Full Disclosure

  • Some SIM / USIM card security (and ecosystem) info October 4, 2024
    Posted by Security Explorations on Oct 04Hello All, Those interested in SIM / USIM card security might find some information at our spin-off project page dedicated to the topic potentially useful: https://security-explorations.com/sim-usim-cards.html We share there some information based on the experiences gained in the SIM / USIM card security space, all in a hope this […]
  • SEC Consult SA-20240930-0 :: Local Privilege Escalation via MSI Installer in Nitro PDF Pro (CVE-2024-35288) October 1, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Sep 30>
  • Backdoor.Win32.Benju.a / Unauthenticated Remote Command Execution September 29, 2024
    Posted by malvuln on Sep 28Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/88922242e8805bfbc5981e55fdfadd71.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Backdoor.Win32.Benju.a Vulnerability: Unauthenticated Remote Command Execution Family: Benju Type: PE32 MD5: 88922242e8805bfbc5981e55fdfadd71 SHA256: 7d34804173e09d0f378dfc8c9212fe77ff51f08c9d0b73d00a19b7045ddc1f0e Vuln ID: MVID-2024-0700...
  • Backdoor.Win32.Prorat.jz / Remote Stack Buffer Overflow (SEH) September 29, 2024
    Posted by malvuln on Sep 28Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/277f9a4db328476300c4da5f680902ea.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Backdoor.Win32.Prorat.jz Vulnerability: Remote Stack Buffer Overflow (SEH) Description: The RAT listens on TCP ports 51100,5112,5110 and runs an FTP service. Prorat uses a vulnerable component in a secondary malware […]
  • Backdoor.Win32.Amatu.a / Remote Arbitrary File Write (RCE) September 29, 2024
    Posted by malvuln on Sep 28Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/1e2d0b90ffc23e00b743c41064bdcc6b.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Backdoor.Win32.Amatu.a Vulnerability: Remote Arbitrary File Write (RCE) Family: Amatu Type: PE32 MD5: 1e2d0b90ffc23e00b743c41064bdcc6b SHA256: 77fff9931013ab4de6d4be66ca4fda47be37b6f706a7062430ee8133c7521297 Vuln ID: MVID-2024-0698 Dropped...
  • Backdoor.Win32.Agent.pw / Remote Stack Buffer Overflow (SEH) September 29, 2024
    Posted by malvuln on Sep 28Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/68dd7df213674e096d6ee255a7b90088.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Backdoor.Win32.Agent.pw Vulnerability: Remote Stack Buffer Overflow (SEH) Description: The malware listens on TCP port 21111. Third-party attackers who can reach an infected machine can send specially crafted sequential packetz […]
  • Backdoor.Win32.Boiling / Remote Command Execution September 29, 2024
    Posted by malvuln on Sep 28Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/80cb490e5d3c4205434850eff6ef5f8f.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Backdoor.Win32.Boiling Vulnerability: Unauthenticated Remote Command Execution Description: The malware listens on TCP port 4369. Third party adversaries who can reach an infected host, can issue single OS commands to […]
  • Defense in depth -- the Microsoft way (part 88): a SINGLE command line shows about 20, 000 instances of CWE-73 September 29, 2024
    Posted by Stefan Kanthak on Sep 28Hi @ll, CWE-73: External Control of File Name or Path is a well-known and well-documented weakness. as well as demonstrate how to (ab)use just one instance of this weakness (introduced about 7 years ago with Microsoft Defender, so-called "security software") due to...
  • SEC Consult SA-20240925-0 :: Uninstall Password Bypass in BlackBerry CylanceOPTICS Windows Installer Package (CVE-2024-35214) September 29, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Sep 28SEC Consult Vulnerability Lab Security Advisory < 20240925-0 > ======================================================================= title: Uninstall Password Bypass product: BlackBerry CylanceOPTICS Windows Installer Package vulnerable version: CylanceOPTICS
  • Apple iOS 17.2.1 - Screen Time Passcode Retrieval (Mitigation Bypass) September 29, 2024
    Posted by Patrick via Fulldisclosure on Sep 28Document Title: =============== Apple iOS 17.2.1 - Screen Time Passcode Retrieval (Mitigation Bypass) Release Date: ============= 2024-09-24 Affected Product(s): ==================== Vendor: Apple Inc. Product: Apple iOS 17.2.1 (possibly all < 18.0 excluding 18.0) References: ==================== VIDEO PoC: https://www.youtube.com/watch?v=vVvk9TR7qMo The vulnerability has been patched in the latest release of […]

Customers

Newsletter

{subscription_form_1}